Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 594616 (CVE-2016-2827, CVE-2016-5256, CVE-2016-5257, CVE-2016-5270, CVE-2016-5271, CVE-2016-5272, CVE-2016-5273, CVE-2016-5274, CVE-2016-5275, CVE-2016-5276, CVE-2016-5277, CVE-2016-5278, CVE-2016-5279, CVE-2016-5280, CVE-2016-5281, CVE-2016-5282, CVE-2016-5283, CVE-2016-5284)

Summary: <www-client/firefox{,-bin}-{45.4.0,49.0}: multiple vulnerabilities
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: major CC: mozilla
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: A2 [glsa cve]
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 590330    

Description Agostino Sarubbo gentoo-dev 2016-09-21 12:26:38 UTC
From ${URL} :

ANNOUNCED: September 13, 2016
FIXED IN: Firefox ESR 45.4

CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [HIGH]
Reporter: Atte Kettunen
Description: An out-of-bounds write of a boolean value during text conversion with some unicode characters. [1291016]

CVE-2016-5272 - Bad cast in nsImageGeometryMixin [HIGH]
Reporter: Abhishek Arya
Description: A bad cast when processing layout with input elements can result in a potentially exploitable crash. [1297934]

CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [HIGH]
Reporter: Nils
Description: A use-after-free vulnerability triggered by setting a aria-owns attribute [1287721]

CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [HIGH]
Reporter: Nils
Description: A use-after-free issue in web animations during restyling. [1282076]

CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [HIGH]
Reporter: Nils
Description: A user-after-free vulnerability with web animations when destroying a timeline [1291665]

CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [CRITICAL]
Reporter: Nils
Description: A potentially exploitable crash caused by a buffer overflow while encoding image frames to images [1294677]

CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [HIGH]
Reporter: Mei Wang
Description: Use-after-free vulnerability when changing text direction [1289970]

CVE-2016-5281 - use-after-free in DOMSVGLength [HIGH]
Reporter: Brian Carpenter
Description: Use-after-free vulnerability when manipulating SVG format content through script [1284690]

CVE-2016-5284 - Add-on update site certificate pin expiration [HIGH]
Reporter: Multiple people
Description: Due to flaws in the process we used to update "Preloaded Public Key Pinning" in our releases, the pinning for add-on updates became ineffective in early September. An attacker who was able to get a mis-issued certificate for a Mozilla web site could 
send malicious add-on updates to users on networks controlled by the attacker. Users who have not installed any add-ons are not affected. [1303127]

CVE-2016-5250 - Resource Timing API is storing resources sent by the previous page [MODERATE]
Reporter: Catalin Dumitru 
Description: URLs of resources loaded after a navigation started can leak to the following page through the Resource Timing API, leading to potential information disclosure. [1254688]

CVE-2016-5261 - Integer overflow and memory corruption in WebSocketChannel [HIGH]
Reporter: Samuel GroƟ
Description: An integer overflow error in WebSockets during data buffering on incoming packets resulting in attacker controlled data being written at a known offset in the allocated buffer. [1287266]

CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [CRITICAL]
Reporter: Mozilla developers
Description: Mozilla developers and community members Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson Smith, Philipp, and Carsten Book reported memory safety bugs present in Firefox 48 and Firefox ESR 45.3. Some of 
these bugs showed evidence of memory corruption and we presume that with enough effort at least some of these could be exploited to run arbitrary code. [Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4]

@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Ian Stakenvicius (RETIRED) gentoo-dev 2016-09-21 19:47:53 UTC
(In reply to Agostino Sarubbo from comment #0)
> @maintainer(s): after the bump, in case we need to stabilize the package,
> please let us know if it is ready for the stabilization or not.

www-client/firefox{,-bin}-{45.4.0,49.0} are now in gentoo repo to address the above.  I will stabilize firefox-bin-45.4.0 myself, as well as firefox-45.4 for  amd64.  

Please stabilize www-client/firefox-45.4.0 for target KEYWORDS="ppc ppc64 x86"

FYI, mail-client/thunderbird-45.4 is two weeks or more away, if it's OK I would like to piggy-back it on this bug once it is available.
Comment 2 Yury German Gentoo Infrastructure gentoo-dev 2016-09-23 05:39:24 UTC
Ian for thunderbird just create a simple stabilization bug and have it block this one. It will be a lot easier to keep track of stabilization that way.
Comment 3 Jeroen Roovers (RETIRED) gentoo-dev 2016-09-25 20:07:27 UTC
Stable for PPC64.
Comment 4 Agostino Sarubbo gentoo-dev 2016-09-29 09:07:59 UTC
x86 stable
Comment 5 Agostino Sarubbo gentoo-dev 2016-09-29 13:09:29 UTC
ppc stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 6 Ian Stakenvicius (RETIRED) gentoo-dev 2016-09-29 14:15:53 UTC
(In reply to Agostino Sarubbo from comment #5)
> ppc stable.
> Maintainer(s), please cleanup.
> Security, please add it to the existing request, or file a new one.

Cleanup complete - thank you!
Comment 7 GLSAMaker/CVETool Bot gentoo-dev 2017-01-03 13:02:41 UTC
This issue was resolved and addressed in
 GLSA 201701-15 at
by GLSA coordinator Thomas Deutschmann (whissi).